Critical Security Update for libxslt: Addressing Use-After-Free Vulnerability
Summary
ALSA-2025:7410: Important: libxslt security update. Affects libxslt versions < 1.1.34-13.el9_6. Fixed in 1.1.34-13.el9_6. How to fix ↓
Check if this vulnerability affects your application
Upload a manifest or SBOM and we'll show whether you're affected, plus every other risky package in the same scan.
No signup required · Results in about 60 seconds
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
Background
libxslt is a widely used library designed for transforming XML files into various textual formats, such as HTML and plain text, utilizing the XSLT stylesheet transformation mechanism. This library is integral for applications that rely on XML data manipulation and presentation. However, it has been identified to have a security vulnerability that could potentially compromise applications utilizing this library.
Vulnerability Detail
The vulnerability identified in libxslt is a Use-After-Free issue located in the function xsltGetInheritedNsList. This flaw allows an attacker to exploit memory that has already been freed, leading to potential arbitrary code execution or application crashes. The origin of this vulnerability is linked to improper memory management within the library, which can be exploited if an attacker can control the input XML data. The ramifications of this vulnerability are significant, as it could allow malicious actors to execute harmful code within the context of the application using libxslt.
How To Fix
Minimum fixed version
1.1.34-13.el9_6
This is the first release that contains the fix.
sudo dnf update libxsltTip — Not sure which version your app runs? Vulert can match this fix to it. Scan free →
Workaround
As a temporary workaround, if updating the package is not immediately feasible, consider isolating the application that uses libxslt from untrusted input sources. This may help mitigate the risk of exploitation until the patch can be applied.
Conclusion
In summary, the libxslt library has a critical Use-After-Free vulnerability that requires immediate attention. Users are advised to update to the latest patched version to safeguard their applications. Utilizing tools like Vulert can further enhance security by providing real-time monitoring for vulnerabilities.
See every vulnerability recorded for libxslt →
FAQ
The vulnerability is a Use-After-Free issue that can lead to arbitrary code execution or application crashes.
You can use the Vulert playground at Vulert Scanner to check if your application is affected by this vulnerability without any signup.
Failing to address this vulnerability could expose your application to potential attacks, leading to data breaches or system compromise.
Yes, the vulnerability is fixed in version 1.1.34-13.el9_6 of libxslt.
Vulert monitors and alerts for open-source vulnerabilities in software using a manifest file like package-lock.json, providing real-time updates on potential threats.
Related vulnerabilities
Recent vulnerabilities recorded for libxslt.
Habilume
Habit tracker with a companion that grows with you
Complete habits, earn Lume Points, and watch your Lume grow as you stay consistent.
